Pexip Infinity CVE-2025-32096

Exploitation requires network reachability to the Pexip Infinity signaling interface on a vulnerable version (33.0 through 37.0, i.e., any release before 37.1); the attacker sends crafted/malformed signaling input that fails input validation and triggers a software abort. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites, so default deployments with an exposed signaling endpoint are affected. The principal limiting factor is exposure: impact is confined to availability (A:H, with C:N/I:N), so the risk is service disruption of conferencing rather than compromise, and organizations that restrict signaling-interface reachability reduce the attack surface.

Signals are internally consistent but modest in urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated condition, and the sole impact is availability (C:N/I:N/A:H), yielding 7.5 - a classic reachable-assertion DoS (CWE-617) with no confidentiality or integrity exposure. No EPSS score, SSVC decision, or KEV entry was provided, and there is no public exploit identified at time of analysis, so the evidence for real-world exploitation is absent rather than negative. The practical priority is MODERATE: easy to trigger over the network and service-disrupting for a live video-conferencing platform, but it cannot be used for code execution, data theft, or lateral movement, so it is a availability/uptime concern rather than a breach vector. The CVSS network vector is coherent with the description's reference to 'signaling,' so no vector/description conflict is present; the main missing signals are exploitation-probability data (EPSS) and any POC, which should be monitored.

A remote, unauthenticated attacker sends a malformed signaling message to an internet-reachable Pexip Infinity node, hitting an improperly validated input path that triggers a software abort. The affected process crashes or restarts, dropping or preventing conferencing sessions; repeated messages can sustain the outage. No public exploit code is known, so an attacker would need to craft the malformed signaling input themselves.